Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

WinAdCtl

Dudley

Posted 18 November 2004 - 08:16 AM

I have a problem with my computer running slow and locking up frequently. I ran Ad-aware yesterday and have all critial Windows updates downloaded. The problem, I believe, is with Windows Ad Control. I tried to run Norton Internet Security this morning and it froze up before I could chose to run virus scan.

I also ran Spybot yesterday and deleted several files. After hitting Ctrl-Alt-Del, I tried multiple times to end task on WinAdCtl and WinAdata. Also showing up in the screen was Winrebates0 and Winrebates1. I believe I deleted the Winrebates from my computer.

I saw your instructions to another user on deleting Windows AdControl from his computer, but wanted you to check my HijackThis log files to see if there are any other items I should delete that could be causing other problems with my computer.

I also noticed there is a new file "Salm". I don't know what it is for and have not seen it before.

coachwife6

Posted 18 November 2004 - 09:06 AM

coachwife6

SuperStar

Retired Staff

11,413 posts

Hi Dudley. Please edit your post and take out your e-mail adddress. Also, click on the Hijack This signature and download the latest version of Hijack This. You have an old version. Run the scan with the new version and post your new log.

C:\WINDOWS\SYSTEM\MSBE.DLLC:\WINDOWS\NEM220.DLLC:\WINDOWS\SYSTEM\WINdirect.exeC:\PROGRAM FILES\WINDOWS ADCONTROL\WINADCTL.EXEC:\PROGRAM FILES\WINDOWS ADCONTROL\WINADALT.EXEC:\TEMP\SALM.EXE<<<what is this? If you don't know and don't need it, get rid of it.C:\WINDOWS\2_0_1browserhelper2.dll

Reboot

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.

First, in the main window, look in the bottom right corner and click on Check for updates now and download the latest reference files.

Next, we need to configure Ad-aware for a full scan.

-> Click on the Gear icon (second from the left) to access the preferences/settings window

1. In the General window make sure the following are selected:

Automatically save log-file

Automatically quarantine objects prior to removal

Safe Mode (always request confirmation)

2. Click on the Scanning button on the left and select :

Scan Within Archives

Scan Active Processes

Scan Registry

Deep Scan Registry

Scan my IE favorites for banned URL’s

Scan my Hosts file

Under Click here to select drives + folders, choose:

All of your hard drives

-> Click on the Advanced button on the left and select:

Include additional process information

Include additional file information

Include environment information

Include additional object details

-> Click the Tweak button and select:

Under the Scanning Engine:

Unload recognized processes during scanning

Include basic Ad-aware settings in logfile

Include additional Ad-aware settings in logfile

Under the Cleaning Engine:

Let Windows remove files in use at next reboot

-> Click on Proceed to save the settings.

-> Click Start and on the next screen choose Activate in-depth Scan at the bottom of the page and then choose:

Use Custom Scanning Options

-> Click Next and Ad-aware will scan your hard drive(s) with the options you have selected.

-> Save the log file when it asks and then click Finish

-> When finished, mark everything for removal and get rid of it. (Right-click the window and choose Select All from the drop down menu and click Next).

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example C:\WINDOWS\Temp\C:\Temp\C:\Documents and Settings\username\Local Settings\Temp\Also delete your Temporary Internet Files, be sure to also select delete all offline content.

> Reboot your computer.

If you would please, rescan with HijackThis and post a fresh log in this same topic.

coachwife6

Posted 19 November 2004 - 09:27 AM

How do you prevent spyware from being installed again? We strongly recommend installing SpywareBlaster (it's free for personal use) Click Here.

Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.Restrict the actions of potentially dangerous sites in Internet Explorer.Consumes no system resources.

Download, run, check for updates, download updates, select all, protect against checked. All done. Check for updates every couple of weeks. If you have any errors running the program like a missing file see the link at the bottom of the javacool page.

It's also very important to keep your system up to date to avoid unnecessary security risks. Click Here to make sure that you have the latest patches for Windows.

These next two steps are optional, but will provide the greatest protection.1. Use ANY browser besides Internet Explorer, almost every exploit is crafted to take advantage of an IE weakness. We usually recommend FireFox .2. Install Sun's Java. It's much more secure than Microsoft's Java Virtual Machine .

It's okay to delete the Hijack This folder if everything is working okay.

After doing all these, your system will be thoroughly protected from future threats.